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, It has been known for some time that graph isomorphism reduces to the hidden subgroup problem 

ly-j ■ (HSP). What is more, most exponential speedups in quantum computation are obtained by solving in- 

stances of the HSP. A common feature of the resulting algorithms is the use of quantum coset states, 
which encode the hidden subgroup. An open question has been how hard it is to use these states to solve 
graph isomorphism. It was recently shown by Moore, Russell, and Schulman | MRS05 1 that only an 
exponentially small amount of information is available from one, or a pair of coset states. A potential 
source of power to exploit are entangled quantum measurements that act jointly on many states at once. 
We show that entangled quantum measurements on at least f2(nlogn) coset states are necessary to get 
useful information for the case of graph isomorphism, matching an information theoretic upper bound. 
This may be viewed as a negative result because highly entangled measurements seem hard to imple- 
ment in general. Our main theorem is very general and also rules out using joint measurements on few 
coset states for some other groups, such as GL(n, ¥ p m ) and G n where G is finite and satisfies a suitable 
property. 
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§ ■ 1 Introduction 

Almost all exponential speedups that have been achieved in quantum computing are obtained by solving 
some instances of the Hidden Subgroup Problem (HSP). In particular, the problems underlying Shor's al- 
gorithms for factoring and discrete logarithm [Sho97], as well as Simon's problem [Sim94], can be nat- 
$_i ■ urally generalized to the HSP: given a function / : G — » S from a group G to a set S that is constant 



on left cosets of some subgroup H < G and distinct on different cosets, find a set of generators for 
H. Ideally, we would like to find H in time polynomial in the input size, i.e. log|G|. The abelian 
HSP [Kit95 BH97 ME98|, i.e., when G is an abelian group, lies at the heart of efficient quantum al- 
gorithms for important number-theoretic problems like factoring, discrete logarithm, Pell's equation, unit 
group of a number field etc. ISho97l IHal()2l IHal()5IISV05l . 

It has been known for some time that graph isomorphism reduces to the HSP over the symmetric 
group IB ea97llEHK99al . a non-abelian group. While the non-abelian HSP has received much attention as a 
result, efficient algorithms are known only for some special classes of groups [IMS03 FIM+03 MRRS04 
BCD05 1. On the other hand, the HSP presents a systematic way to try and approach the graph isomorphism 
problem, and this approach is rooted in developing a deeper understanding of how far techniques and tools 
that have worked in the abelian case can be applied. To the best of our knowledge, the only other approach 
to solve graph isomorphism on a quantum computer is by creating a uniform superposition of all graphs 
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isomorphic to a given graph. It has been proposed to create this superposition via quantum sampling of 
Markov chains [AT03], however, very little is known about this. 

One of the key features of a quantum computer is that it can compute functions in superposition. This 
fact alone does not lend itself to exponential speedups, for instance for unstructured search problems it 
merely leads to a polynomial speedup [Gro96 BBBV97]. On the other hand, the quantum states resulting 
from HSP instances have far more structure since they capture some periodicity aspects of the function 
/. Evaluating the function / in superposition and ignoring the function value results in a random coset 
state. Coset states are quantum states of the form \gH) = ^L^. ^2 heH \gh), in other words, a coset state 

is a uniform superposition over the elements of the left coset gH. The challenge in using coset states lies 
in the fact that g is a random element of the group, beyond our control, that is, we only have the mixed 
state cr^r = J2 g eG \9H){gH\ and we have to determine H from it. Though it is conceivable that some 
advantage can be had by making use of the function values, currently there are no proposals for using 
function values in any meaningful way. 

How much information can be extracted from coset states? The most general way to extract classical 
information from quantum states are POVMs [NC00|. A fixed POVM operates on a fixed number k of coset 
states at once. This induces a probability distribution over the set of classical outcomes associated with the 
POVM. A potential source of power with no classical analog is that the distribution induced by a POVM 
on k coset states may have significantly more information than a POVM that acts on just one coset state 
at a time. In other words, the resulting distribution when the POVM is applied to k coset states can be far 
from a product distribution. In this case we say that the POVM is an entangled measurement. The goal of 
this paper is to determine how small k can be made such that a polynomial amount of information about 
H can be obtained from a POVM on k coset states. More precisely, we want to know how small k can be 
so that there exists a POVM on k coset states that gives polynomially large total variation distance between 
every pair of candidate hidden subgroups. Note that this POVM can have many classical outcomes, and it 
may have to be repeated several times if we want to identify the actual hidden subgroup H with constant 
probability. 

In this paper, we show that for many groups G this number k has to be quite large, sometimes as large as 
fi(log \G\). This matches the information theoretic upper bound of O (log |G|) for general groups [EHK99b|. 
Our result can be viewed as a negative result because highly entangled measurements seem hard to imple- 
ment in general. Note that the time required to perform a generic measurement entangled across k states 
increases exponentially with k. 

For abelian groups the picture simplifies dramatically. Indeed, in this case a POVM operating on one 
coset state (i. e., k = 1) exists that gives a polynomial amount of information about the hidden subgroup. 
Moreover, this measurement is efficiently implementable using the quantum Fourier transform over the 
group. The Fourier based approach extends to some non-abelian groups as well, e. g., dihedral, affine and 
Heisenberg groups, and shows that for these groups there are measurements on single coset states that give 
polynomially large information about the hidden subgroup [EHOO MRRS04, RRS05]. 

Other than the general information-theoretic upper bound, only a few examples of measurements oper- 
ating on more than one coset state (i. e., k > 1) are known that give a polynomial amount of information 
about the hidden subgroup. Kuperberg [Kup03] gave a measurement for the dihedral group operating on 
2 0(\/log|G|) coset states that also takes 2 0( V lo g l G D time to implement. Bacon et al. IBCD05I gave an ef- 
ficiently implementable measurement for the Heisenberg group operating on two coset states, and similar 
efficient measurements for some other groups operating on a constant number of coset states. 

The case of the symmetric group S n has been much harder to understand. First it was shown that some 
restricted measurements related to the abelian case cannot solve the problem [HRT03]. Next the non-abelian 
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aspects of the group were attacked by Grigni et al. [GSVV04] who showed that for hidden subgroups in S n , 
measuring the Fourier transform of a single coset state using random choices of bases for the representations 
of S n gives exponentially little information. They left open the question whether a clever choice of basis 
for each representation space can indeed give enough information about the hidden subgroup. Recently, a 
breakthrough has been made by Moore, Russell and Schulman [MRS05] who answered this question in the 
negative for k = 1 by showing that any measurement on a single coset state of S n gives exponentially little 
information, i. e., any algorithm for the HSP in 5 n that measures one coset state at a time requires at least 
exp(0(n)) coset states. Subsequently, Moore and Russell [MR05| extended this result by showing that any 
algorithm that jointly measures two coset states at a time requires at least exp(f2(y / ra/log re)) coset states. 
However, their techniques fail for algorithms that jointly measure three or more coset states at a time, and 
they left the k > 3 case open. 

In this paper, we show that no quantum measurement on k = o(n log n) coset states can extract poly- 
nomial amount of information about the hidden subgroup in S n . Thus, any algorithm operating on coset 
states that solves the hidden subgroup problem in S n in polynomial time has to make joint measurements 
on k = f2(ralogre) coset states, matching the information theoretic upper bound. Our results apply to the 
hidden subgroups arising out of the reduction from isomorphism of rigid graphs, and rules out any efficient 
quantum algorithm that tries to solve graph isomorphism via the standard reduction to the HSP in S n using 
measurements that act jointly on less than n log n coset states at a time. 

Our lower bound holds for a more general setting: Given a group G, suppose we want to decide if the 
hidden subgroup is a conjugate of an a priori known order two subgroup H, or the identity subgroup. We 
show a lower bound on the total number of coset states required by any algorithm that jointly measures at 
most k states at a time and that distinguishes between the above two cases. Our main theorem uses only 
properties of G that can be read off from the values of the characters at the two elements of H. We also 
prove a transfer lemma that allows us to transfer lower bounds proved for subgroups and quotient groups 
to larger groups. Using our main theorem and the transfer lemma, we show lower bounds on the order of 
entangled measurements required to efficiently solve the HSP using coset states in groups PSL(2,F p m), 
GL(n,F p m), and groups of the form G n , where G a constant-sized group satisfying a suitable property, 
including all groups (S m ) n where m > 4 is a constant. The case of (S^)™ is interesting, because there is an 
efficient algorithm for the HSP making joint measurements on states using the orbit coset techniques 
of [FIM + 03|. However, the orbit coset approach creates coset states not just for the hidden subgroup H, 
but also for various subgroups of the form HN, where N < (S^)™. This example suggests that one way to 
design efficient algorithms for the HSP making highly entangled measurements may be to use coset states 
for subgroups of G other than just the hidden subgroup H. 

Recently, Childs and Wocjan [CW05| proposed a hidden shift approach to graph isomorphism. They 
established a lower bound for the total number of hidden shift states required and also showed that a single 
hidden shift state contains exponentially little information about the isomorphism. Our results generalize 
both their bounds and imply that o(n log n) hidden shift states contain exponentially little information about 
the isomorphism. 

The chief technical innovation required to prove our main theorem is an improved upper bound for the 
second moment of the probability of observing a particular measurement outcome as we vary over different 
candidate hidden subgroups. In particular, we give a new and improved analysis of the projection lengths 
of vectors of the form b b onto homogeneous spaces of irreducible representations of a group. The 
earlier works [MRS05 MR05| tried to bound these projection lengths using simple geometric methods. As 
a result, their methods failed beyond k = 2 for the symmetric group. Instead, we make crucial use of the 
representation-theoretic structure of the projection operators as well as the structure of the vectors, in order 



3 



to prove upper bounds on the projection lengths better than those obtainable by mere geometry. This allows 
us to prove a general theorem that applies with large k for many groups. 

Finally, we also prove a simple lower bound on the total number of coset states required by any algorithm 
to solve the HSP in a group G. This lower bound gives a simple proof of the fact that distinguishing a hidden 
reflection from the identity subgroup in the dihedral group D n requires f2(logn) coset states. 

2 Preliminaries 

2.1 Graph isomorphism and HSP 

The usual reduction of deciding isomorphism of two n-vertex graphs to HSP in S2 n actually embeds the 
problem into a proper subgroup of Szn, namely, S n I S2 [EHK99a|. The elements of S n I S2 are tuples 
of the form (tt, a, 6) where ir,a S S n and b € 1,2 with the multiplication rule (tti, 01, 0) • (tt2, 02 > 6) := 
(7Ti7T2, 01 02, b) and (71-1,01,1) • (7^,0-2,6) := (7110-2, 01^2, 1 © Tne embedding of S n I S 2 in S 2n 
treats {1, . . . , 2n} as a union of {1, . . . , n} U {n + 1, . . . , 2n} with tt, a permuting the first and second sets 
respectively when 6 = 0, and tt permuting the first set onto the second and and a permuting the second set 
onto the first when 6=1. There is an element of the form (71-, tt~ 1 , 1), called an involutive swap, in the 
hidden subgroup iff the two graphs are isomorphic. 

Additionally, if the two graphs are rigid, i. e., have no non-trivial automorphisms, then the hidden sub- 
group is trivial if they are non-isomorphic, and is generated by (it, tt^ 1 , 1) if they are isomorphic where tt is 
the unique isomorphism from the first graph onto the second. This element (tt, tt~ 1 , 1) is of order two, and 
is a conjugate in S n I S2 of h := (e, e, 1) where e G S n is the identity permutation. Viewed as an element 
of S2n, h = (1, n + 1)(2, n + 2) • • ■ (n, 2n). The set of conjugates of h in S n I S2 is the set of all involu- 
tive swaps (tt, tt" 1 , 1), tt G S n , and corresponds exactly to all the isomorphisms possible between the two 
graphs. Also S n I S2 is the smallest group containing all involutive swaps as a single conjugacy class. This 
algebraic property makes S n I S2 ideal for the study of isomorphism of rigid graphs as a hidden subgroup 
problem. Note that graph automorphism, i. e., deciding if a given graph has a non-trivial automorphism, is 
Turing equivalent classically to isomorphism of rigid graphs [KST93|. 

In this paper, we consider the following problem: Given that the hidden subgroup in S n I S2 is either 
generated by an involutive swap or is trivial, decide which case is true. Graph automorphism as well as 
rigid-graph isomorphism reduces to this problem. We show that any efficient algorithm using coset states 
that solves this problem needs to make measurements entangled across fi(nlogn) states (Corollary [T4l. 
Note that any lower bound for this problem for a coset state based algorithm holds true even when the 
involutive swaps are considered as elements of Sin rather than S n I S2. This is because of the following 
general transfer lemma. 

Lemma 1 (Transfer lemma). Let G be a finite group and suppose that either G<GorG = G/N, N <G 
holds. Then lower bounds for coset state based algorithms for the HSP in G transfer to the same bounds for 
the HSP in G and vice versa, as long as the hidden subgroups involved are contained in G. 

Proof. Let H < G. The case G < G follows from the observation that C[G] = ®- g< zG/G L 9 ' C i G }> 
where G/G denotes a system of left coset representatives of G in G and Lg stands for left multiplication 
by g. Then, 0^ = ©^ G( 5/ G L g ■ ■ L~, and so any coset state based algorithm without loss of generality 

performs the same operations on each block of the orthogonal direct sum. The case G = G/N follows from 
the observation that C[G] is isometric to the subspace of C[G] spanned by coset states of N namely states of 
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the form \gN), g G G. There is a subgroup H <G,N <H such that H/N = H. Hence, erg = cr£. Thus, 
any coset state based algorithm without loss of generality performs the same operations on <rg and cr?. □ 

Childs and Wocjan [CW05] showed an U(n) lower bound for the total number of hidden shift states 
required to solve graph isomorphism, and also proved that a single hidden shift state contains exponentially 
little information about the isomorphism. However, their results do not rule out an algorithm that makes joint 
measurements on, say, two states at a time and uses a total of 0{n) hidden shift states. Since the hidden shift 
state corresponding to the shift (tt, vr _1 ), where n G S n / 2 is exactly the coset state for the hidden subgroup 
generated by the involutive swap (tt, tt -1 , 1) in S n / 2 I S2, Lemmanand Corollary [Pfl of our paper show 
that any efficient algorithm using hidden shift states to solve the graph isomorphism problem needs to make 
measurements entangled across f2(nlogn) states, generalizing their results. 



2.2 Quantum Fourier transform and POVMs 

We collect some standard facts from representation theory of finite groups; see e.g. the book by Serre [ S er771 
for more details. We use the term irrep to denote an irreducible unitary representation of a finite group G 
and denote by G a complete set of inequivalent irreps. For any unitary representation p of G, let p* denote 
the representation obtained by entry-wise conjugating the unitary matrices p(g), where jgG. Note that the 
definition of p* depends upon the choice of the basis used to concretely describe the matrices p(g). If p is 
an irrep of G so is p* , but in general p* may be inequivalent to p. Let V p denote the vector space of p, define 
dp := dim V p , and notice that V p = V p *. The group elements \g), where g G G form an orthonormal basis 
of C' G L Since ^2 pe g d 2 p = \G\, we can consider another orthonormal basis called the Fourier basis of C' G ' 

indexed by \p, i,j), where p G G and i,j run over the row and column indices of p. The quantum Fourier 
transform over G, QFT G is the following linear transformation: 

~d~ dp 

It follows from Schur's orthogonality relations (see e.g. ISer771 Chapter 2, Proposition 4, Corollary 3]) that 
QFT G is a unitary transformation in C' G L 

For a subgroup H < G and p G G, define p(H) := ^ ^2 heH p{h). It follows from Schur's lemma (see 
e.g. ISer77l Chapter 2, Proposition 4]) that p(H) is an orthogonal projection to the subspace of V p consisting 
of vectors that are point- wise fixed by every p{h), h G H. Define r p (H) := rank(p(iT)); then r p (H) = 
jm ^2heH Xp{h), where \p denotes the character of p. Notice that r p (H) = r p * (H). For any subset S < G 

we define \S) := — }= ^2 seS \s) to be the uniform superposition over the elements of S. The standard 

• ' \s\ 




method of attacking the HSP in G using coset states I GSVV043 starts by forming the uniform superposition 
7^ E 9 gg Iff) I )- 11 then q uer i es / to get the superposition -J= Y. 9 eG lff)l/(ff))- Ignoring the second 

register the reduced state on the first register becomes the density matrix erg = X] 5 eG lff-^0 (ff^1> tnat i s 
the reduced state is a uniform mixture over all left coset states of H in G. It can be easily seen that applying 
QFT G to erg gives us the density matrix jgj pg g 0j=i \p, i) (p, A ® P* (H), where p* (H) operates on the 
space of column indices of p. When measuring this state, we obtain an irrep p with probability dp]{H ^p { - H '> m 
Conditioned on measuring p we obtain a uniform distribution l/d p on the row indices. The reduced state 
on the space of column indices after having observed an irrep p and a row index i is then given by the state 
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p*(H)/r p (H), and a basic task for a hidden subgroup finding algorithm is how to extract information about 
H from it. 

If the the hidden subgroup is the trivial subgroup {1}, the probability of measuring p is given by the 

d 2 

so-called Plancherel distribution V(p) := r&. This distribution will be useful to us later on in the proof of 
the main theorem. 

POVMs are the most general way to obtain classical information from quantum states [NC00|. The ele- 
ments of a POVM M. in C n are positive operators Ei > which have to satisfy the completeness condition 
Y^i E{ = t n . If the state of the quantum system is given by the density matrix a, then the probability pi to 
observe outcome labeled i is given by the Born rule pi = Tr(aEi). The following observation is crucial for 
the HSP case: since the states are simultaneously block diagonal in the Fourier basis for any H < G, 
the elements of any POVM M. operating on these states can without loss of generality be assumed to have 
the same block structure. From this it is clear that any measurement to identify H without loss of generality 
first applies the quantum Fourier transform QFT G to a^, measures the name p of an irrep, the index i of a 
row, and then measures the reduced state on the column space of p using a POVM M. p in C dp . This POVM 
M. p may depend on p but is independent of i. 

Furthermore, M. p can be assumed to be a frame, i. e., a collection B p := {(a,b, b)}, where b G C dp with 

= 1 and < at < 1 such that J2beB a b\t>)(b\ = ld p i.e. a frame is a POVM with rank one elements. 
Orthonormal bases are special cases of frames in which = 1 for all b G B p . We can assume that the 
POVM on the column space is a frame because any POVM can be refined to a frame such that for any 
quantum state, the probabilities according to the original POVM are certain sums, independent of the state 
measured, of probabilities according to the frame. 

If the the hidden subgroup is the trivial subgroup {1}, after observing an irrep p and a row index i, the 

reduced state on the space of column indices of p is the totally mixed state ^ £ -. The probability of observing 

P d 2 

a vector b in frame B p is given by the so-called natural distribution on B p defined by J\f{b \ p) := r^r. This 
distribution will be useful to us later on in the proof of the main theorem. 

The above description was for single register quantum Fourier sampling. Fourier sampling on k registers 
can be defined analogously. Here one starts off with k independent copies of the coset state a^, i. e., with 
the state Og)® fc ^ o% and applies QFT| fc to it. Here G k , H k denote the fc-fold direct product of G, H 
respectively. Note that since G k = G® k , we have that QFT Gfc = QFT® fe . We can express an irrep p of G k 
as p = ® k =l Pi, Pi G G; observe that V p = ® k =1 V Pi . We adopt the convention that multiregister vectors and 
representations are denoted in boldface type. After applying QFT^, we measure the name p of an irrep 
of G k , i. e, irreps pi, . . . , pf. of G. After that, we measure a row index of p i. e., row indices of p±, . . . , 
and then measure the resulting reduced state in the column space of p using a frame B of V p . The frame B 
used depends on the observed p but not on the observed row indices. Notice that only the application of the 
frame B may be an entangled measurement, the application of QFTg* and measurement of p together with 
a row index of p are single register operations. 

3 The main theorem 

Let G be a group and h G G be an involution, that is, H := {1, h} is an order two subgroup of G. We 
let H 9 := gtig^ 1 denote the conjugate of H by g G G. Let A; be a positive integer. Fix a POVM J\A on 
C[G]® k = C[G k ]. Let M.H3, -M{i} denote the classical probability distributions obtained by measuring 
the states crf^, afh respectively according to M. We will show that the average total variation distance 
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between Mhs and M{iy over conjugates H 9 , g G G is at most 2 fc times a quantity that depends purely on 
the pair (G, H). In the next section, we will show that this quantity is exponentially small for many pairs 
(G, H) of interest, including when G = S n I S2 and H is generated by an involutive swap, i. e., the case 
relevant to isomorphism of rigid graphs. 

Theorem 2 (Main theorem). Let G be a finite group and H := {l,h} be an order two subgroup of G. 
Let k > 1 be an integer. Fix a POVM M on C[G]® k and let Mna, -M{i} denote the classical probability 
distributions obtained by measuring the states a®*, crfh respectively according to M. For e > 0, define 



the set 





Suppose that 2ke < 1 holds. Define 

M v _ IXrWI|-|»|<e + 

and 
Then 




S 2 := 2 k (l + 2ke)5{ /2 + 3ke + ^ • ^ 4- 



E g [\\M H s --Mwlli] < $2, 
where the expectation is taken over the uniform distribution on g £ G. 

By a fc-entangled POVM T on t coset states, we mean that T consists of a sequence of POVM's 
(■M-i)ie[t'h where each A4i operates on a fresh set of at most fc-coset states and t' < t. The number of 
coset states operated upon by T is at most t. The outcome of T is a sequence of length t' corresponding 
to the outcomes of Mi. The choice of Mi may depend on the observed outcomes of Mi, ■ ■ ■ , Mi-\. If 
required, further classical postprocessing may be done on the outcome of T . We now prove the following 
corollary of Theorem |2l 

Corollary 3. Suppose T is a k-entangled POVM on t coset states. Then for at least a fraction of 1 — y/tfo 
conjugate subgroups H 9 , g G G, 

Proof. Using Theorem|2land triangle inequality, it is easy to see that E g [|| — ^{i})^] < t&2- Applying 
Markov's inequality to the expectation over g G G finishes the proof. □ 

The remainder of the section is devoted to proving Theorem 13 We first give some notation that will be 
useful for the proofs of various lemmas. Our notation and setup is inspired to a large extent by the notation 
in IMR05I . 

As argued in the previous section, we can assume without loss of generality that M first applies QFT^ fc 
to cf^i, measures the name of an irrep of G k , p* together with a row index of p*, and then measures the 
resulting reduced state in the column space of p* using a frame & of V p * = V p . If p = ® k = iPi, Pi G G, 
then p* = (& k =l p*. The frame 3 used depends on the observed p* but not on the observed row indices. 
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Suppose the hidden subgroup is H 9 for some g £ G. It is easy to see that the probability that M. 
measures p* is given by 



d n AH9\ 



■ r. 



m 9 Y 



: d p r p (H k ) 



Notice that M H s(p*) = M H (p)- Let B 



\G\ k \G\ k 
{ab,b}, where < ay, < 1 and X^b a b|t>)(b| 



Then 



the reduced state in the column space of p* is 



P{{Hv) k ) 



particular b conditioned on having observed p* is 



M H a( h | p* 



,(#*) 



, if r p ^ 0. Hence, the probability of observing a 



q b (b|p((ffg) fc )|b) 



if r p (H k ) / 0, and otherwise. Similarly, if the hidden subgroup is the identity subgroup then 



where V() is the Plancherel distribution on irreps of G k . Also 



M {1} (b\p* 



where J\f(- \ p*) is the natural distribution corresponding to the frame B. 



For a non-empty subset / C [k], define p 1 := (®i^ipi) (8> (C 



Ve[fc]\/ld, 



where I,/ denotes the 



identity representation of G of degree equal to that of . For non-empty subsets I\ , I2 Q [k] , define 



J1J2 



p ±L := p 1 p . For a representation = ®" =1 ^i of G™, 9{ representation of G, we use 0(g) as a 
shorthand for ®" =1 ^i(g). For an irrep r G G, we use o!^ to denote the multiplicity of r in the Clebsch- 
Gordan decomposition of 0, i. e. the number of times r occurs in when is viewed as a representation of 
G embedded as the diagonal subgroup of G n . We let n!^ denote the orthogonal projection from Vq onto the 
homogeneous component of r in the above decomposition. We use the following shorthand for expectations: 
E p [-], Eb[-] and E g [-] denote expectations over the Plancherel distribution on irreps, natural distribution on 
frame vectors and uniform distribution on elements of G respectively. 
We define a function X : G® k x B x G -► [-1, 1] as 



X(p,b,g) := b p((H") 



b -^r 



1 

2k- 



where B is a frame for V p . The importance of X will become clear in Lemma ITT1 below, which shows that 
E Pi b, g [\X(p, b, g)\) is closely related to the total variation distance between Mjjb and M-\i}- 

We start by proving the following lemma, which is similar to [MR05 Lemma 11]. The lemma gives 
us a way to express the second moment of X in terms of projections of 'coupled' frame vectors b <8> b 
onto homogeneous components corresponding to irreps r G G. The advantage of doing this is that we 



can now distinguish between 'good' irreps, namely those with 



IXrWI 



small, and 'bad' irreps, namely those 



where ^ Xr } h ^ is large. The contribution of 'good' irreps to the second moment of X is small. This idea of 
distinguishing between 'good' and 'bad' irreps goes back to [MRS05|. 

Lemma 4. 

E g [X(p,h,g) 2 



1 

4F 



E E 

h,hf^{}reG 



Xr(h) 

d T 



n^ lJ2 (b. 



b^ 
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Proof. Since 



X(p,b,g) 



i(<i»|i4,l b > + E< b l^" 1 )l b ))-i 



^E< b l^" l )l b > 



we get 



E g [X(p,b,g) 2 ]=E 9 



1 2 <b|^(^-i)| b > . (bl^c^-^lb) 



1 £ E fl [<b®b|/^^- 1 )|b®b>] 



1 



E E * 



b (8) b 



T<=G 



- y 



- y 



bob 



b«b 



tGG 



! E 9 b~(s^ 



bob 



bob 



-GG 



bob 



1 

4T 



E E^|K' l2 ( b ^ 

/l,/2#{}rGG T 



The fifth equality above follows from Schur's lemma. □ 

Lemma|4]takes care of the 'good' irreps. However for 'bad' irreps r, we have to do something to bound 
nf (bob) . The ] capers MRS 05 , MR05] tried to bound it using the following simple geometric 
argument: If B is an orthonormal basis for V p , then {b O b}bes is an orthonormal set in V p O V p . Hence the 

expectation, over the uniform distribution on B, of the above quantity is upper bounded by ran 1 d T '-. If B 

is a POVM rather than an orthonormal basis, a similar argument can be made. This simple method works for 
k = 1, 2 for the symmetric group, but fails for k > 3. This is because rank(n£ 1 2 ) becomes larger than d p . 
The problem with the simple method is that rank(nf 1 2 ) can be potentially as large as d? p . This is where 

we need new ideas as compared to those in [MRS05 , MRQ5J. We use the fact that the projection Ilf 1 2 is 
not arbitrary, but is rather the projection onto the homogeneous component corresponding to an irrep of G. 
There is an explicit representation-theoretic formula for such a projection operator (see e.g. I Ser77l Chapter 
2, Theorem 8]). Using this formula allows us to 'decouple' nf 1 2 (bob) into an expression involving only 
p lx and b, and p l2 and b, that is, it allows us to remove the tensor product. This 'decoupling' gets around 
the problem that the rank of the projector can be larger than d p whereas the size of the basis B is only d p . 
It allows us to apply a standard corollary of Schur's orthogonality relations and finally bound the length of 
the projection of b O b by a small quantity. 
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We now state a few facts that will be used in our 'decoupling' arguments. The next fact is easy to show 

2 



and was used in the simple geometric approach of [ MRS05 MR05 1 to bound 



Fact 5. Let W be a subspace of V. Let B := {a^, b} be a frame for V. Let Tlyy denote the orthogonal 
projection from V onto W. Then 

^ rii^i/ ,, \ n2, dim W 

■MKmii ] = — , 

where the expectation is taken over the natural distribution on B. 

The following fact is a special case of [MR05 , Lemma 12], and can be easily proved by considering the 
regular representation of G n . 

Fact 6. Let := (®" =1 6i) (g) ^(^)^ =1 1^., J be a representation of G n+n ' , where 9i £ G and Id.., is the 
identity representation of G of dimension dy. Suppose each 0{ is chosen independently from the Plancherel 
distribution on G. Fix r 6 G. Let a® denote the multiplicity of t in the Clebsch-Gordan decomposition of 6 
i. e. viewing 6 as a representation of G embedded as the diagonal subgroup of G n+n . Then 



d T 

W\ 



The following fact is a standard result in representation theory (see e.g. |Ser7T, Chapter 2, Proposition 
4, Corollary 3]), and follows from Schur's orthogonality relations. 



Fact 7. Suppose r G G and b G V T , 



= 1. Then, 

EJ (b\r(g)\b)\ 2 } 



1 



We start off the 'decoupling' process by the following lemma. 
Lemma 8. Fix h,I 2 ^ [k], h,h^ {}, P G G m , r £Gandb£ V p . Then, 



Proof. 



nr ,2 (b®b) 



b) < ^(E ff [| <b \p h (g)\b) | 2 ] + E fl [| <b \p^{g)\ h) 



bob 



h® h 

= | (bob \d T E g [ XT {gTp h {g) ® P h (g)]\b ® b) | 

= d T |E 3 [ Xr ( 5 r <b \p h (9)\ b> • <b |p /2 ( 5 )| b>]| 

< d 2 E,[|<b|p^(5)|b>|-|<b|p^( 5 )|b>|] 

< | (E,[| <b 1^(5)1 b) | 2 ] + E g [\ <b |^( 5 )| b> | 2 ]) . 

The second equality follows from a standard result in representation theory describing the projection oper- 
ator onto a homogeneous component corresponding to an irrep of G (see e.g. ISer77l Chapter 2, Theorem 
8]), the first inequality follows by bounding a character value by the dimension of the representation, and 



the second inequality follows from the fact that \xy\ < 



for any pair of complex numbers x,y. □ 
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We now prove a crucial lemma that allows us to prove good upper bounds on 



n? 1,a (b®b) 



Lemma 9. Fix I C [k], I / {}. Then, E PibjS [| <b |p 7 (o)| b> | 2 ] < E 



\G\ 



Proof. We use the notation r -< p 7 to denote a single copy of t 6 G occurring in the Clebsch-Gordan 
decomposition of p 7 i.e. treating p 7 as a representation of G embedded in the diagonal of G k . A given r € G 
can occur more than once in the decomposition, or not at all. We let b r denote the orthogonal projection of 
b onto this copy of r. Note that if r occurs more than once, then there will be several orthogonal vectors 
b T . If ||b r || > 0, define b r to be b r normalized; otherwise, let b T be an arbitrary unit vector in the copy of 
r under consideration. We now have 











2 


2 


b|p 7 (a)|b)| 2 = 






') 




E ^r\r{g)\h T ) 






T-ip 1 






T-ip 1 



< 



E ll bT ll ' ll br ll \ br l T ^l br 

T-ip 1 



E ) • ( E iib T |i 2 i(b r |r( 5 )|b T 

T-ip 



= E l|b T || 2 |(b r |r( 5 )|b 

T-ip 1 

The inequality above follows from Cauchy-Schwartz, and the last equality is because J2 T ^p r II b 



1. Now, 



E p , b J <b|p 7 (a)|b)| 2 ] 
^ E P,b,g 



E 



E n br ii 2 ( br i r ^i br 
--ip 1 

E l|b T || 2 E 9 [|(b T |r( 5 )|b T )| 2 | 



E 



T-ip 



E 



E, 



E 



E b [||b T 



E, 



E 



T-ip 



d T 



E, 



rSG 



= E e p 

TSG 



The second equality follows from Fact0 the fourth equality follows from Fact|5]and the last equality follows 
from Fact|6] □ 
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The next lemma ties up the above threads to prove an upper bound on the second moment of the function 
X independent of k. 

Lemma 10. E Pih>g [X(p, b,g) 2 } < e + p • ^E d v \ ■ ^E d r \xAh)\j . 



Proof. First, note that 

E g [X(p,b,g) 2 ] 



< 



< 



J_ \p y Xr(h) 
\Xr{h)\ 



E E 



4fc ^ d 



n^ 1,/2 (b®b) 



n^ lJ2 (b®b) 



j E kE ||nr 2 (b0b)| 2 + j: 



\Xr(h)\ 



U^ 1 ' 2 (bob) 



< e 



+ 4^ E^ 



4fc Z-^ Z-^ ^ 

/i,/ 2 ^{}Te5 e 



n£ 1,2 (b®b) 



The equality follows from Lemma|4]and the fact that the quantity in the absolute value sign is non-negative, 
and the last inequality follows from the fact that Y^ T ^.Q\S ^ 1 2 (b ® b^ 
Fix h,h ^ [k], h, h / {}■ Then, 



< ||b®b|r = i. 



E 



P .h 



E 



n£ /1,/2 (b®b; 



< E 



P ,b 



E ^# • I foil < b \p h (9)\ b> I 2 ] + E s [| <b \pH9)\h" ' 2 



E 

Vre5 e 



.TSS e 

dr|x T (/t)| 



dr 2 

E Plb , 9 [| <b \ P h (g)\ b> | 2 ] + E p>b , g [| <b |p%)| b> | 2 ]) 



< 



The first inequality is due to Lemma|S]and the second inequality is due to Lemma[5] Combining the above 
two upper bounds proves the present lemma. □ 

We now connect the function X to the total variation distance between M.hb and 

Lemma 11. Define p g := E Pj b[|X(p, b, g)\]. Suppose 2ke < 1. Then, 

3k 

\\M H 9 - M^yWi < 2 fc (l + 2fe)^ + 3te + — • E 



reSs 
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Proof. If the hidden subgroup is H 9 for some g G G, the probability of observing an irrep p* G row 
index i £ [d p ] and frame vector b G B is given by 

Mif S (p,i,b)=M^(p)--^-M^(b | p*). 

If the hidden subgroup is {1}, the probability of observing an irrep p* G G® k , row index i 6 [d p ] and frame 
vector b G 2? is given by 

^ { i } (p,i,b)=P(p)~-JV(6|p). 



Define a new probability vector M' Ha as 



^ fl (p,i,b) := V{p) .-.M H9 (b\ p*). 



Define a set S £ := {p G : 3z G G 5 £ }. Define another new vector M'^y with non-negative 

entries as 

otherwise 



M'( 1} (p,i,b) :-- 



Note that -M'^y may not be a probability vector. 

Define D £ := E^ TgiSe Let 'P(Se), V(S £ ) denote the probabilities of S £ , S £ under the Plancherel 



distributions on G, G® fe respectively. Then, V{S £ ) < kV{S £ ) = Also since 



d r . 



2 k r p (H k ) 



i=i 



\d Pi +Xpi(h) 



i= i \ a ft / 



we have 



By the convexity of the function y = x k , we have that |(1 — e) k — 1| > |(1 + e) k — 1|. Since 2/ce < 1, 
it can be shown by induction that (1 — e)~ k < 1 + 2ke. Hence, 

d n 



2 k r p {H k ) 



< 2ke, for p G G® k \ S 



Now, 



M'l 1} -M m l 



E EE 



EEEw 



pes £ i=i beB 



<ip <ip 



E £"M-r 

ped® k \s £ b e B p 
< J] P(p)-2fe + 



2 k r p (H k ) 



+ E w 



|G| 
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Next, 



M' H3 -M" {1 



«lli 

dp 

E EE 



p(p). l-.M Ha {h\ p*)-V(p) ' 



d p 2 k r p (H k ) 



pe<S £ i=l beB 



- E WE 

pe3® k \s e beB 

< E w 



a b <b|p((^) fc )|b> ab 



r, 



,(1T*) 



2 k r p (H k ) 



+ E 

pe<s e 



beB 



b 



2 k 



+ 



< 2 k (l + 2ke) ^ P(p)-E b [|X(p,b, 5 )|] + 

p£G® k \S e 



kD £ 
W 



< 2 fc (l + 2te)E p , b [|X(p,b, 5 )|] + 



kD £ 

w 



2 k {l+2k£)Pg + 



kD £ 
W 



Furthermore, 



K^--^lli= E EE 

p g g®fc i=l beB 



p(p) • J- • (b | p*) — M.h{p) • -7- • Mj* 9 (b | p* 
dp d p 



E \r(p)-M H ( P )\<k-J2 

peG» fe reG 



_ d T \H\r T {H) 

W\ 



\G\ 



fc -E 



reG 



_ d T (d r + XrW) 

|G| 



reG 



|G| 



E 



v reG\5 £ 



4. IXrWI 

|G| ' d T 



+ £mI<H £ E 



res £ 



reG\5 £ 



|G| 



|G| + |G| 



2 ke + 



kD £ 
W 



The first inequality follows from k applications of the triangle inequality. Finally, 

\\M H o ~M {1} \\ x < \\M H v -Mm^ + M' HB -M'l l} j + M\ l} -M {1] 
< 2 k (l + 2ke)p g + 3ke + ^-- ^ d\. 

Tfci £ 

We are now ready to prove the main theorem of the paper. 



□ 



Proof of Theorem^ The theorem follows from Lemmas QO] and ^2 using the convexity of the square func- 
tion. The upper bound on b\ follows from the observation that Cauchy-Schwartz implies that J2 U ^Q ^ v — 



|G| 1/2 (£, 6 G^) 1/2 = |G| 1/2 |G| 1/2 - 



□ 
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Finally, we prove a simple lower bound, irrespective of the order of entanglement, on the total number 
of coset states t required to distinguish a hidden subgroup H 9 from the identity hidden subgroup. For that, 
we need the following theorem. 



Theorem 12. Let G be a finite group and H := {1, h} be an order two subgroup of G. Let t > 1 be an 
integer. Then, 

E<? [ a H9\ 



a 



<8>t 
{1} 



tT <]G\J2 d r\xAh)\. 



Proof. Let p G G® 4 , J C [£], I ^ {}. Using arguments similar to those above, it is easy to see that 



53 e 9 [p 1 ^^- 1 )] 



E,[2*p((fl»)*)]-p({l}*)|| tr = 


E 9 
















tr 



-6G 



tr 



¥{}r6G 



Writing the density matrices in the Fourier basis and using Fact|6]we get, 



Eg [o"f s 



Ha\ °"{i} 



tr 



\G\> 



©©|pM)(pM|®p((fl»)*) 



p i=i 



|G| 



^©©ipM>(^.ii®p({i}*; 



p i=i 



tr 



^©©|p*,i)(p*,i|^(E ff [2V((F s ) t )]-K{l}*)) 



|G| 



p i=i 



tr 



EEM*)i(E^) = EE^ 

^{} r6G V P 1 1 P / 7^{} Te g 1 1 



^{} 

2* 



r6G 



□ 



Corollary 13. Any algorithm using a total of t coset states that distinguishes with constant probability 
between the case when the hidden subgroup is trivial and the case when the hidden subgroup is H 9 for some 
g £ G must satisfy t = 0(log(l/^)). 

Proof. The algorithm can be viewed as a two-outcome POVM that outputs 1 with probability at least 2/3 if 
the hidden subgroup is non-trivial, and with probability at least 2/3 if the hidden subgroup is trivial. Thus, 
the POVM distinguishes between the states E 9 [cr® * ] and af*y with constant total variation distance. Since 
the trace distance is always an upper bound on the total variation distance, invoking Theorem IT21 completes 
the proof. □ 
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The above corollary shows, for example, that any coset state based algorithm solving the HSP in S n I S 2 
needs a total number of f2(n log n) coset states. In the next section, we apply Theorem|2]to show a stronger 
result, namely, any algorithm solving the HSP in S n lS2 using polynomially many coset states needs to make 
measurements entangled across O(nlogrt) coset states. However, Corollary [T3lcan sometimes prove non- 
trivial lower bounds on the total number of coset states for solving the HSP in groups G where Theorem |2] 
can only prove a constant lower bound on the order of entanglement. For example, the HSP in groups 
G := A x Z2, where A is an abelian group and Z2 acts on A by inversion can be solved by an algorithm using 
a total number of O (log | G \ ) coset states that measures one coset state at a time [ EHOO ] . Using Corollary [nj 
one can show a matching £l(log \G\) lower bound on the total number of coset states when A is the cyclic 
group Z n , i. e., G is the dihedral group D n . Using a different technique, Childs and Wocjan [CW05 1 in fact 
show an ri(log |G|) lower bound on the total number of coset states for the above groups for all abelian A. 



4 Limitations of quantum coset states for HSP: Examples 

4.1 The wreath product S n I S 2 and graph isomorphism 

The representation theory of the wreath product G = S n I S 2 is well-known. The following is a summary 
of the necessary results, for more details we refer to Appendix EJ the wreath product has irreps k\ : \/ of 
dimension 2d\dy, where A, A' 6 S n , A / A'. Define h := (e, e, 1) € G, where e is the identity permutation 
in S n . The character value of h on these irreps is zero. Furthermore, there are irreps $\ and $' A of dimension 
d\, where A € S n . The character values of $\ and $' A on h are given by d\ and — d\, respectively. The total 
number of irreps of G is |G| = ( p ^) + 2p(n) < p{n) 2 , where p(n) denotes the number of partitions of n. 

In order to apply Theorem[2]we choose e = n~ an for some constant a > to be determined later. Then 
S £ = |ct e G : i^j^ > e} = {&\,# x : d x < n an } . Hence we obtain that 

d,, ■ \ X v{h)\ <2 d\-d x <p{n)n 2an -n an <n Zan e u ^. 



Here we have estimated the partition number as p(n) = 0(e u ^™), where v = Try |. We also compute that 

^2 d 2 a < 2 d t< P(n)n ian < n 4an e u ^. 

In order to apply Theorem |2j we now define a := 1/4 and obtain that 



Si < e+[ Y,d,\Xa(h)\] ($\ ' < n - an + n 3an e^( p{n)2Xl/2 



\G\ ) ~ \2(n\) 2 



3/4n 2v^fn 

y/2n\ 



where we have used the fact that nl > (n/e) n for large n. For the parameter 8% in Theorem[2]we obtain 

S 2 = 2 fc (l + 2ke)5\ 12 + She + ^ E ^ *° 



\G\ 

< 2 k ( 1 + 2kn~ 1 / 4n ) n~ n ^ + Sku^^ + 3^^-^ = 2 k n~ n ^. 
\ ) 2{n\Y 
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Hence, we have proved the following corollary to Theorem^ 



Corollary 14. Any algorithm operating on coset states that solves the hidden subgroup problem in G = 
S n I S2 in polynomial time has to make joint measurements on k = f2(nlogn) coset states. The same is 
true for any algorithm that solves the hidden subgroup problem in S n using coset states. Also, any efficient 
algorithm for isomorphism of two n-vertex graphs that uses the standard reduction to HSP in S2n an d then 
uses coset states to solve the HSP needs to make measurements entangled across k = Q(nlogn) coset 
states. 

Finally, we remark that if we apply Theorem |2] to all the full-support involutions in S2 n , we only get 
a lower bound of k = Q(n). This is because we use Roichman's [Roi96| upper bound on the normalized 
characters of Sin in order to define S 6 , as in [MRS05|, and Roichman's bound is always at least e~ 0( - n \ 
Since the involutive swaps form an exponentially small fraction of all the full-support involutions, it is 
possible that an average hidden full-support involution may be distinguishable from the hidden identity 
subgroup by an O(n) -entangled POVM acting on n°( 1 )-coset states. However, no such POVM is known 
and the best upper bound for this problem continues to be the k = 0(n log n) information-theoretic one. 

4.2 The projective linear groups PSL(2, ¥ q ) 

The representation theory of the projective linear groups G = PSL(2,F g ) over any finite field ¥ q is well- 
known. The following is a summary of the necessary results, for more details we refer to Appendix |B] We 
treat the cases q even and , odd separately. In case q odd we have that |PSL(2,F a )| = There is 

one conjugacy class of <? ^ 1 ^ involutions (depending on whether q = 1 or 3 modulo 4); let h denote a fixed 
member of this conjugacy class. The degrees of the irreps are given by 1, q, q ± 1, and 2M xhe character 
values \x(h)\ can be upper bounded by 1, 1, 2, and 1, respectively. There is a total number of |G| = 



irreps. 



In order to apply Theorem |3 we choose e = — j. Then 



5 E = {^G:Mil 



>£} = {!} 



contains only the trivial irrep. With this choice of the parameter e we have that 




and 




Hence, we can bound the parameter 5\ used in Theorem[2]as follows: 




< 



q-1 



2 




For the parameter 62 we obtain 



6 2 = 2 k {l + 2ke)5{ /2 + 3ke + 
< 2 k (l + 2k^—) 0(q- ] 



3k J2 a es E d a 
\G\ 



q-1) 



/2 ) + 3k—?— + 3k 



q-1 



q(q 2 ~ l)/2 



1 



< 2 k O{q- 1/2 ). 
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The case q = 2 n , where |PSL(2,F 2 n)| = |SL(2,F 2 »)| = q(q 2 - 1), can be treated similarly. There we 
use e = which implies that 5 2 < 2 k O(q~ 1 / 2 ). Hence, using Theorem|2]we have shown the following 
result: 



Corollary 15. Let q be a prime power. Then any algorithm operating on coset states that solves the 
hidden subgroup problem in G = PSL(2,F g ) in polynomial time has to make joint measurements on 
k = f2(log \ G\) = £l(q) coset states. 



4.3 Special and general linear groups 

Corollary 16. Any algorithm solving the HSP in SL(2, F„) or GL(2, ¥ q ) efficiently using coset states needs 
to make measurements entangled across k = f2(log q) registers. 

Proof. By Corollary [T31 any algorithm solving the HSP in PSL(2, ¥ q ) efficiently using coset states needs to 
make measurements entangled across k = 0(log q) registers. The statement now follows from LemmafTJby 
using the facts that PSL(2,F g ) 9* SL(2, F,)/C(SL(2, F,)) and that SL(2, ¥ q ) < GL(2, ¥ q ). □ 

Corollary 17. Any algorithm solving the HSP in GL(n,F p m) efficiently using coset states needs to make 
measurements entangled across k = Q(n(m\ogp + log re)) registers. 

Proof. Since GL(re,F p m) contains all n x n permutation matrices, a lower bound of k = O(nlogre) fol- 
lows from Corollary fill and LemmafTJ Also, we can use the embedding of GL(2,F p nm) < GL(2n, ¥ p m) 

via ( a , I 1— M ^ I , where for each x G F„nm the matrix M T G GL(re,F„m) reahzes mul- 

V c d J V M c M d J p p 

tiplication by x with respect to a fixed basis of F p »» over ¥ p m. Hence by Lemma|l]we obtain that for the 
HSP in GL(2n, ¥ p m) at least as much entanglement is necessary as in case of GL(2, ¥ p nm). The latter has 
been bounded by Q(nm logp) in Corollary [T6l □ 



4.4 Direct products of the form G n 

In this section we show that for a large class of finite groups G, efficient algorithms for HSP for direct 
products of the form G n , where n > 1, require entangled measurements on at least k = fi(n) coset states. 
Let G be a finite group and let G = {o~\, . . . , a m } denote the irreducible representations of G. Recall that 
the centralizer C(g) of an element g G G is the subgroup C(g) := {c G G : eg = gc}. Let h be an 
involution in G, and let a G G. Then either \xa(h)\ = d a or < 1 - holds IGal94l . We define 

e := (1 — ^igp Y, where t = t{n) is a function of re to be determined later. 

The irreps of G n , where n > 1, are given by a := u\ (8> . . . <8> cr n , where o~i G G. We let A := {a G G : 
\Xa{h)\ = d a }, A := Y^aeA d l' and I 1 := T, ae d\A d l = \ G \~ X - The following property of the set 

S e :=LeG- M\- M >e\ 

holds for our choice of the parameter e: if a G S £ then necessarily at least n — t positions erj have to be from 
A, i. e., have to satisfy |x CTi (/i)| = d av Indeed, otherwise we would have more than t positions a a in each 

of which ^ Xa ^ - < 1 — , making the product less than e. We next give an estimate for the quantity 

S<re<s £ d a- appearing in Theorem |2 For that we require the following lemma for estimating the tail of the 
binomial distribution. 
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Lemma 18. Let a,(3>0, let n > 1, and let t = n/c, where c > ^i^. Then 



n 

■ n 



£=n-t 

Proof. We have that 



-n—t t=n—t 

< (a + py " ^ 1 " 



n — tj \a + (3 



t J \ a J \ ta J \ \ a 

where the first inequality follows from the union bound on probabilities and the second one from (") < 

(¥)'• □ 

Suppose we fix £ > n — t locations for putting in irreps from A. The contribution of this configuration to 
S<reS £ * s tne sum OI " P r °ducts of squares of dimensions of I irreps from A and n — I irreps from G\A, 
which simplifies to X e u n ~ e . Letting a := A, (3 := /i, and t = n/c, with some constant c to be determined 
later, we obtain the following bound from Lemma \TE\ 

Hence, for any given k > we can find a constant c > such that J2a-£S E ^<x — (1 + K ) n holds 
for all n > c. Note that the same upper bound applies to Ylrj£S s d a \X(r{h, . . . , h)\. Also, observe that 

J2 p eQ n dp = (j2 p ed dp) ■ Now, we can bound the parameter 5\ used in Theorem|2| 



61 * e+ \G\ 



\peG 



For the following we make the assumption that \G\ > A(l + k) y^2 pe Q d p j holds. This implies that there 
exists a constant 71 > such that 5\ < 7™. For the parameter 62 in Theorem[2]we obtain 



< 2 k 1 + 2k 



n / c \ ,„ / o\nthM\ n l c 



Now, since our assumption implies that |G| > A(l + k), we obtain that there exists a constant 72 > such 
that 62 < 72 • Hence, we have proved the following corollary to Theorem[2] 
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Corollary 19. Let G be a finite group and let h G G be an involution. Let G denote the set of irreps of 
G and let A := {a £ G : \Xa(h)\ = d a }. Suppose that \G\ > (J2 a eA^o-) (j2 p eQ ^p) no ^ s - Then any 
efficient algorithm operating on coset states that distinguishes between the case when the hidden subgroup 
is a conjugate of the subgroup ((h, . . . , h)) < G n , and the case when the hidden subgroup is the identity 
subgroup in G n , needs to make measurements entangled across Q(n) registers. 

Recently, Alagic, Moore and Russell [AMR05] showed that any measurement on a single coset state 
gives exponentially little information about a hidden subgroup in the group G n , where G is fixed and satisfies 
a suitable condition. Their condition on G is weaker than our condition in Corollary but they only prove 
lower bounds for algorithms measuring one coset state at a time. They also give several examples of families 
of groups satisfying their condition, including all non-abelian finite simple groups. In fact, the condition of 
Corollary \W\ holds for all families of groups G considered in their paper, showing that efficient coset state 
based algorithms solving the HSP for their families of groups G n need to make measurements entangled 
across Q(n) registers. 

From Corollary ^1 it is easy to prove Corollary l20l via the Cauchy-Schwartz inequality. 

Corollary 20. Let G be a finite group and let h G G be an involution. Let G denote the set of irreps of 
G and let A := {a G G : \Xa(h)\ = d a }. Suppose that \G\ 1/2 > \G\ 1/2 (X^eA 6 ^) holds. Then any 
efficient algorithm operating on coset states that distinguishes between the case when the hidden subgroup 
is a conjugate of the subgroup ((h, . . . , h)) < G n , and the case when the hidden subgroup is the identity 
subgroup in G n , needs to make measurements entangled across Q(n) registers. 

Using Corollary |20l we prove the following result. 

Corollary 21. Any efficient algorithm operating on coset states that distinguishes between the case when 
the hidden subgroup is a conjugate of the subgroup ((h, . . . , h)) < (S m ) n where h G S m is any involution 
and m > 5 is fixed, and the case when the hidden subgroup is the identity subgroup in (S m ) n , needs to make 
measurements entangled across Q(n) registers. The same holds also when m = 4 and h = (1,2) G S4. 

Proof. Let G = S m , where m > 5, and let h be any involution in G. Recall that for m > 5 all irreps of S m 
of degree greater than 1 are faithful [ JK81 , Theorem 2.1.13], and that the center of S m is trivial. Since for 
faithful a G S m we have that |x CT (^)| = da implies that h is in the center, we obtain that |x CT (/t)| < d a for 
all a G S m with d a > 1. Hence A = {1, alt} consists of the trivial and the alternating character only and 

we obtain that J2 a eA d l = 2 - Since for m - 5 we nave tnat \ G \ 1/2 = Vm\ > 2y/p(m) = \G\ 1/2 XaeA d l, 
where p(m) denotes the partition number of m, the statement for m > 5 follows from Corollary |2"U1 

For m = 4 and h = (1, 2) we observe that the set A is again given by A = {1, alt}. We verify that the 
condition IS4I 1 / 2 = \/24 > 2\/5 = IS4I 1 / 2 X CT eA d 2 a holds. Hence the statement for this case also follows 
from Corollary l20l □ 
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A Representations of the wreath product S n I S2 

We describe the irreducible representations of the wreath product S n \S2, i- e., the group (S n x S n ) x Z2. We 
will also get formulas for the character values under these representations in terms of the character values 
of irreducible representations of S n . 

Let S n = {cij : i = 1, . . . ,p(n)} denote the irreducible representations of S n , where p(n) denotes 
the number of partitions of n. Denote the degree of ai E S n by di. Letting N := (S n x S n ) and G := 
(S„ x S„) x Z2 we have that N <3 G is a normal subgroup of index 2. The irreducible representations 
of N are given by N = {<7j ® aj : i,j = 1, . . . ,p(n)} and we define the shorthand faj := ai (g) o~j. 
Define t := (e, e, 1) 6 G, where e is the identity permutation in S n . A transversal of N in G is given by 
T = {(e, e, 0), t}. Then t acts on N as (<jj (8) off = (aj (8> 0i). Hence we have that ■ = 4>j,i- Since all 
4>ij are pair- wise inequivalent, we obtain the following two cases from Clifford's Theorem IIsa76l . 

(i) i = j. Then faj = (f>\ ■. Hence fcj has precisely 2 pairwise inequivalent extensions to G. One of 
these extensions is ?9j = ^3 in which the image of t permutes the tensor factors of C di (8) C di , where 
di = deg(<Ti). Hence if {ep. : k = 1, . . . ,di} denotes the standard basis of C di then "di(t) is given 
by the matrix SWAP^ which maps (8> ci 1— ► ci <8> &k- The other extension of <j>^ to G is given 
by defining the image of t to be $'(t) := — Note that both extensions have degree df. The 
character value tr(??j(t)) is given by the number of invariant tensors under the swap operation, i. e., 
tr(i?j(t)) = di and tr (??•(*)) = -dj. 

(ii) ? 7^ j. Then 0jj ^ • = ^ Hence Kjj := (pij |t G is irreducible. Moreover, we have that 

(<t> id It G) I N = (j)ij® and 
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We summarize the facts relevant for this paper in the following table by showing the images of elements 
of the form (?t, fj,, e) and t = (e, e, 1) under the irreducible representations of G = (S n x S n ) x Z2: 

Irrep Irrep on (it, fi, e) Char, on (n, /j,, e) Irrep on t Char, on t 



#i <Ti(7r) ® <t<(m) X<(»r)Xt(/*) SWAP di d 

< o-i(Tr) ®<Ti(/i) Xi(T)Xi(A*) -SWAP di -d 

cri(vr) (8) <Tj(/z) did \ , . . . t \ ,(,.\ ( Qdidj Idid 



Overall, there are ( p ^) pairwise inequivalent irreducible representations Kjj G G, one for each pair 
i,j such that z / j. We have that the degree of K{,j is given by 2didj. The character Xij of mj satisfies 
Kij(t) = for all % 7^ j. Furthermore, there are 2p(n) pairwise inequivalent irreducible representations 
and ^. 

B Representations of the projective linear groups PSL(2, ¥ q ) 

We briefly recall some facts from the representation theory of the projective linear groups PSL(2, ¥ q ), where 
q is a prime power. Good references on the complex representation theory of these groups are available, see 
e.g, [BZ99 FH91 LR92]. We teeat the cases q odd and q = 2 n separately and begin by describing the 
conjugacy classes of involutions and the irreducible representations of PSL(2, ¥ q ) for q odd. Recall that for 
q odd, the center of SL(2, ¥ q ) consists only of the identity matrix and the matrix 

/ -1 

c:= { -1 

Once the characters of SL(2, ¥ g ) are known, we therefore have to filter out only those characters x for which 
x(c) = x(l) holds in order to obtain the irreducible representations of PSL(2, ¥ q ). 

B.l The case PSL(2, ¥ q ) where q = 1 mod 4 

The involutions are given by conjugates of the residue class of 



h=(° 1 I) GPSL(2,F 9 ), 

where the bar denotes the fact that we are using coset representatives with respect to the center (c) of 
SL(2,Fq). There is a total of Q ^ q ~ 1 ^ many involutions that are conjugates of h. The characters and their 
values on h are summarized in the following table. 



Irrep name 


Parameters 


Number of irreps 


Degree 


Character value at h 


1 




1 


1 


1 


if, 




1 


<J 


1 




fc = 2,4 J ... J 2=i 


q-l 
4 


q-l 





Xj 


J — ^i^i ■ ■ ■ 1 2 


q-5 
4 


q + l 


2 (_i)fc/2 


Q 


i = 1,2 


2 


9+1 
2 


(_l)(9-l)/4 
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B.2 The case PSL(2, ¥ q ) where q = 3 mod 4 

Similar to the previous case all involutions are conjugate to the element h defined as above. However, now 
there are 3i3+ll involutions conjugate to h. The characters and their values on h are summarized in the 
following table. 

Irrep name Parameters Number of irreps Degree Character value at h 



1 — 111 

Y> 1 q -1 

9 k fc = 2,4,...,2=5 ^1 q _ 1 2( _i)fc/2+i 

Xj j = 2,4,...,2z3 ^3 q+1 

% ^=1,2 2 2zi (-1)^ +1 



B.3 The case PSL(2, F,) where g = 2 n 

This case behaves quite differently from the case q odd. First, observe that in this case the center is trivial, 
i. e., PSL(2, = SL(2, F2«). All involutions in SL(2, F2«) are conjugate to the element 

h= ( I \ ) GSL(2,F g ), 

and there is a total number of q 2 — 1 of such involutions. The characters and their values on h are summarized 
in the following table. 

Irrep name Parameters Number of irreps Degree Character value on h 



1 — 111 

Y> — 1 q 

9k fc = l,2,...,§ f ?-l -1 

Xj j = l,2,...,2=2 ^ ? + 1 j 
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